We need minimum n+1 states to build NFA that accepts all substrings of a binary string. For example, following NFA accepts all substrings of “010″ and it has 4 states.
We need a state for counting the length. So, for length n we need n+1 states (one for length zero). We don’t need a reject state for larger strings as we have NFA and not DFA. So, totally n+1 states are required